Send a typed resource reference as the flow trigger goal

What does this MR do and why?

Addresses #628996

This MR sends a typed resource reference as the flow trigger goal.

A custom flow triggered on a resource received that resource's iid on its own. A project numbers issues and merge requests from separate sequences, so one iid routinely names a resource of each type, and a flow resolving it has no way to tell them apart. The problem is that a bare IID does not say whether 23 means issue #23 or merge request !23, so a flow that resolves it can act on the wrong resource and the run is still reported as success because every API call it made succeeded.

The goal now carries a reference that names the resource type and links the object.

Six event types are affected, the ones whose dispatchers send a bare iid: assign, assign_reviewer, merge_request, merge_request_ready, merge_request_code_conflictandwork_item`. Mentions already name the resource type, and pipeline hooks and schedules send a payload or a description rather than a resource reference, so all three are unchanged.

How to set up and validate locally

Prerequisites

• Duo Enterprise enabled
• GDK running with all services up
• Self Managed Local Instance

1. Checkout this branch: 628996/sq/custom-flow-untyped-iid 2. In rails console:

project = Project.find(1000000) # or exchange with your proj ID

# Enable feature flag
Feature.enable(:ai_flow_trigger_typed_resource_goal, project.root_ancestor)

# Create colliding pair (MR and Issue)
mr = FactoryBot.create(:merge_request, source_project: project, target_project: project,
  iid: 500, source_branch: 'verify-source', target_branch: project.default_branch)

issue = FactoryBot.create(:issue, project: project, iid: 500, title: 'Decoy issue 500')

puts mr.to_reference => # !500
puts issue.to_reference  => # #500

3. Create and enable a custom workflow in GDK UI:

• Navigate to Project > AI > Flows > New Flow. E.g. http://172.16.123.1:3000/test-status-bot-e63fd58e/test/-/automate/flows/new
• Enable the flow with mention, assign and assign reviewer event types

4. Trigger MR from the UI

• Open MR created in step 2
• In the right sidebar, set Assignee to the flow service account from step 3

You should see a progress note appear on the MR, authored by the service account, plus a system note linking the agent session.

5. Read the goal:

• Go to GraphQL explorer: http://172.16.123.1:3000/-/graphql-explorer and run

query {
  project(fullPath: <your_project_full_path>) {
    duoWorkflowWorkflows(first: 3) {
      nodes { id goal humanStatus resourceWebUrl createdAt }
    }
  }
}

The goal should name the MR and link the MR URL, with no work item URL anywhere in it. Something like:

Context: MergeRequest: http://127.0.0.1:3000/flightjs/Flight/-/merge_requests/500

6. Trigger Work Item from the UI

• Open Issue created in step 2
• In the right sidebar, set Assignee to the flow service account from step 3

You should see a progress note appear on the Issue, authored by the service account, plus a system note linking the agent session.

7. Read the goal:

• Go to GraphQL explorer: http://172.16.123.1:3000/-/graphql-explorer and run

query {
  project(fullPath: <your_project_full_path>) {
    duoWorkflowWorkflows(first: 3) {
      nodes { id goal humanStatus resourceWebUrl createdAt }
    }
  }
}

The goal should name the work item and link the work item URL, with no MR URL anywhere in it. Something like:

Context: Issue: http://127.0.0.1:3000/flightjs/Flight/-/work_items/500

8. Disable the feature flag

Feature.disable(:ai_flow_trigger_typed_resource_goal, project.root_ancestor)

References

Feature flag rollout issue: #633977

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.